1
$\begingroup$

I have a client-server application, which is transferring data between its components in a secure way. I currently use AES algorithm with CBC mode to transfer data and file. This is the scenario: Client ask for data(file or plaintext), server takes the request and encrypt data with a iv/key pair and sends encrypted data to the client. Client always stores data encrypted. Client is a per user application. So for this reason, client should open the files, should read data even in offline mode. (Server application is .Net based, Client is Delphi)

What I need is a secret key generation mechanism, that is secure and changeable between client and server, something that is related to the current user ('user1', 'user2' etc). I'm not experienced in cryptography, So I will be waiting for the experienced one's advices.

Thanks in advance

Edit: I will try to explain my problem in more details. We have a client application, that is opening some files in some format (say 3dsmax). Those files are downloaded from a database in server and only authenticated user can download this files. But even if authenticated user download this one, files shouldn't be copied to other computers, disks. because those files contain strictly worked models (say 3d models) and need to be encrypted; and there is another case that when client sqlite database need to be updated, we send scripts to the client in an encrypted way and client decrypts and executes, saves values encrypted.

We do all of this work. Perhaps I asked the question not in a proper way. By key generation I mean that, how do we create a mechanism to securely and consistently exchange the data? Preferably without key storage but some mechnaism that creates the key in runtime but in both sides by using userids, licence keys etc... we store user information both in client and server. I hope I could explain

Improve this question
$\endgroup$
3
  • 1
    $\begingroup$ You forgot to handle authentication/integrity (a common error), the key generation and storage mechanism is, sadly, irrelevant. Disregarding this, can you state some more of your requirements? What environment is the client executing in, how long does the data need to remain encrypted at rest, do you allow the user to provide a password to decrypt his files, etc.. $\endgroup$
    – Thomas
    Commented Dec 3, 2012 at 14:09
  • $\begingroup$ Instead of inventing your own system which is bound to have issues, the first place to start is see what is already available that meets your needs or at least 90% of your needs. I would suggest instead of telling us what solution you have already come up with and asking for help solving one problem that has popped up, describe the application and requirements and ask what is available that might fit your needs. $\endgroup$
    – mikeazo
    Commented Dec 3, 2012 at 15:34
  • $\begingroup$ @Thomas added more explanation $\endgroup$
    – ikbal
    Commented Dec 5, 2012 at 8:05

1 Answer 1

Reset to default
2
$\begingroup$

In practice you should use the tools already provided. SSL/TLS and by extension HTTPS are very powerful tools that provide proper implementations of key exchange, authentication and privacy. As far as I can tell this solves all of your problems.

AES-CBC alone is problematic. As Thomas pointed out you lack authentication. A common solution to this problem is using an HMAC and here is a good discussion of HMACs and encryption.

Improve this answer
$\endgroup$
3
  • $\begingroup$ didn't you tell me you were the top answerer on crypto stackoverflow :D $\endgroup$
    – David 天宇 Wong
    Commented Aug 5, 2015 at 8:57
  • $\begingroup$ @David Crypto is awesome Are you at black hat right now? $\endgroup$
    – Rook
    Commented Aug 6, 2015 at 1:29
  • $\begingroup$ this is not practical! Send me a mail through cryptologie.net :P $\endgroup$
    – David 天宇 Wong
    Commented Aug 6, 2015 at 18:09

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.